Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-read`. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
3 versions affected across 1 product
CVE-2026-48935 File Metadata Modification Bypass in Node.js Permission API Read-Only Paths https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-48935
Post summary
The provided text announces the existence of CVE‑2026‑48935, describing a file metadata modification bypass in Node.js. No further proof of exploitation, PoC, or mitigation details are included.
3 of 3 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | nodejs | node.js | 22.22.3 | - | - |
| App | nodejs | node.js | 24.16.0 | - | - |
| App | nodejs | node.js | 26.3.0 | - | - |